Document current Sentinel project state

CLAUDE.md

@@ -21,6 +21,54 @@ Primary functions:
   logged, and tested.
 - Assure: heartbeat, watchdog, self-integrity, future external anchors.
 
+## Current State Snapshot
+
+As of 2026-06-13, the project is a local-first Linux IDS/IPS/EDR agent at
+package version `0.7.0`. The branch has a working stdlib-only daemon, CLI,
+HTTPS management console, incident model, response planner, rootcheck, posture
+checks, file/package integrity checks, push notification backends, and optional
+bcc/eBPF telemetry.
+
+Implemented detection coverage:
+
+- Poll detectors: `reverse_shell`, `ld_preload`, `deleted_exe`,
+  `input_snooper`, `credential_access`, `stealth_network`,
+  `memory_obfuscation`, `new_listener`, `new_suid`, `persistence`, and
+  `egress`.
+- eBPF exec rules: fileless execution from writable paths, reverse-shell argv,
+  web/database service spawning shells, and `curl|wget|sh` style staging.
+- eBPF syscall rules: RWX `mprotect`/`mmap`, `memfd_create`, sensitive
+  `ptrace`, seccomp changes, cross-process memory access, and memory locking.
+- Anti-rootkit checks: hidden PIDs, `/proc` vs `ps` mismatches, hidden modules,
+  hidden TCP/UDP/raw/special-protocol sockets, raw ICMP/SCTP-style channels,
+  promiscuous interfaces, known LKM rootkit names, module taint, and kernel
+  taint.
+
+Implemented investigation/response state:
+
+- Alert snapshots are written as text and JSON under `log_dir`.
+- Incident tracking groups snapshots by process lineage and time window and
+  exposes `incident list/show/export`.
+- The dashboard is HTTPS-only, token-protected off loopback, and read-only. It
+  shows status, incidents, timelines, alerts, posture findings, event tail, and
+  dry-run response plans.
+- `respond plan <incident-id>` builds read-only containment/recovery plans,
+  persists CLI-generated plans under `response-plans/`, and appends
+  `response-audit.log`. Dashboard/API plan previews do not write artifacts.
+- IPS behavior is currently explicit workflow: posture hardening plus reviewed
+  dry-run containment actions. There is no automatic inline blocking or silent
+  host mutation yet.
+
+Near-term open work:
+
+- Audited `--apply` response execution with tests and rollback notes.
+- Baseline reconciliation for legitimate FIM/package/listener/SUID drift.
+- Rule inspection/test commands and generated rule documentation.
+- More event sources and correlation across exec, network, persistence, FIM,
+  and rootcheck signals.
+- Stable schema compatibility tests for alerts, incidents, status, response
+  plans, and response audit records.
+
 Start with:
 
 - `README.md` for product overview and architecture.